registry / minimal-forge-work-pack-sync / 0.1.17
minimal-forge-work-pack-sync@0.1.17
Minimal Forge Work Pack startup synchronization for OpenCode and OpenWork.
AI Security Review
scanned 17d ago · by lpm-firewall-aiSource inspection shows package-aligned Forge synchronization and usage reporting, with credentials selected for the configured origin. The scanner's credential-transfer hint reflects authenticated requests to that same configured service; no concrete attack behavior was identified.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The exported plugin runs when loaded by OpenCode; synchronization starts at plugin initialization, while usage reporting follows a managed skill invocation.
Impact
No unauthorized credential transfer or unrelated agent configuration change was identified.
Mechanism
No confirmed attack surface was established: network requests target the configured Forge origin, and configuration changes use entries tracked by the sync state.
AI rationale
Source inspection shows package-aligned Forge synchronization and usage reporting, with credentials selected for the configured origin. The scanner's credential-transfer hint reflects authenticated requests to that same configured service; no concrete attack behavior was identified.
Evidence
package.jsondist/index.js
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to dist/index.js and defines no install lifecycle hooks.
- The plugin requires a configured Forge origin and restricts it to HTTPS or loopback.
- It reads a Forge API key from the OpenCode auth entry keyed by that same origin.
- Startup uses that origin for manifest synchronization and sends the corresponding API key.
- Usage evidence is sent only after a skill tool uses a Forge-managed pack, and goes to that origin.
- Configuration updates agent and command entries tracked by the sync state.
Evidence against
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/index.jsView file
2613if (typeof node_buffer.Buffer === "function") {
L2614: return node_buffer.Buffer.from(src, "base64");
L2615: } else if (typeof atob === "function") {
...
L5226: yield* this.next(token);
L5227: yield* this.end(forceDoc, endOffset);
L5228: }
...
L5230: *next(token) {
L5231: if (node_process.env.LOG_STREAM)
L5232: console.dir(token, { depth: null });
...
L7731: const credentialId = createHash("sha256").update(credentials.forgeApiKey).digest("hex")
L7732: const report = sk[redacted](origin, credentialId, (events) => fetch(origin + "/sync/evidence", {
L7733: method: "POST", redirect: "error",
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L26132613Trigger-reachable chain: manifest.main -> dist/index.js
L2613: if (typeof node_buffer.Buffer === "function") {
L2614: return node_buffer.Buffer.from(src, "base64");
L2615: } else if (typeof atob === "function") {
...
L5226: yield* this.next(token);
L5227: yield* this.end(forceDoc, endOffset);
L5228: }
...
L5230: *next(token) {
L5231: if (node_process.env.LOG_STREAM)
L5232: console.dir(token, { depth: null });
...
L7731: const credentialId = createHash("sha256").update(credentials.forgeApiKey).digest("hex")
L7732: const report = sk[redacted](origin, credentialId, (events) => fetch(origin + "/sync/evidence", {
L7733: method: "POST", redirect: "error",
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
2 Critical1 High3 Medium6 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to minimal-forge-work-pack-sync@0.1.17.
See all versions of minimal-forge-work-pack-sync for other recorded verdicts.
- Review the evidence and your use of minimal-forge-work-pack-sync@0.1.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.